Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

flare-foundation/fassets

              main @ 6d5c103
            

Fixes

CVEs

HIGH

Peak severity

36.4%

Coverage

Highlights

Access Control: 8 prior fixes. Scrutinize any change in this area.

contracts/assetManager/implementation/AssetManagerController.sol: most-fixed (2 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Multiple proxy upgrade and initialization functions lacked proper authorization, allowing unauthorized implementation changes or re-initialization. Fixes added governance or asset-manager-only modifiers and initialized flags.

Reentrancy: External calls after state updates in nonReentrant functions were vulnerable to reentrancy. The standard OpenZeppelin guard was insufficient across diamond facets; a diamond-storage variant was required.

Payment Validation Bypass: Payment attestation compared the actual receiving address instead of the intended hash, allowing a bypass that could confirm incorrect payments.